PRIVACY IMPACT ASSESSMENT QUESTIONNAIRE
OPA – Department of Labor Web Production Environment System – FY 2011
ABSTRACT
DOL-WPES is the name of the system that will be used to publish the information on the Department of Labor Intranet, LaborNet (http://www.labornet.dol.gov), and it's Internet, DOL.gov (http://www.dol.gov). The system supports OPA business objective of improving the efficiency of information to the public and the DOL strategic plan to transform into a digital Department, and improve service delivery to citizens.
OVERVIEW
- System Name: Department of Labor Web Production Environment System (DOL WPES)
- Owner Agency: Office of Public Affairs Division of Enterprise Communications (OPA DEC)
- DOL.gov is used by DOL as the agency's primary website and means of communication with the public via the Internet.
- LaborNet is an intranet application used by the agency to communicate with internal DOL users and is available via an internal network.
- The DOL.gov and the LaborNet websites publish the Department of Labor's information on the Internet and Intranet, respectively.
- OPA DEC manages the system at the application layer and above.
- OASAM/ITC is responsible for maintaining the system's hardware and network infrastructure.
INTRODUCTION
The purpose of this document is to summarize the findings of the United States Department of Labor Web Production Environment System (DOL-WPES) Privacy Impact Assessment (PIA). The PIA ensures the confidentiality, integrity, and availability of the information contained within the system. This assessment aims to determine what types of data are collected, stored, or shared and by its nature, whether that data will cause an invocation of the Privacy Act of 1974. This document also assesses the risks for system vulnerability.
CHARACTERIZATION OF THE INFORMATION
The following questions are intended to define the scope of the information requested and/or collected as well as reasons for its collection as part of the program, system, or technology being developed.
- Specify whether the system collects personally identifiable information (PII) on DOL employees, other federal employees, contractors, members of the public (U.S. citizens), foreign citizens, or minor children.
The system collects personally identifiable information on DOL employees, contractors and members of the public.
- What are the sources of the PII in the information system?
- The sources of the PII are from DOL employees, contractors and members of the public.
- What is the PII being collected, used, disseminated, or maintained?
- First Name
- Last Name
- Business Address
- Business Email Address
- Business Phone Number
- Residential Address
- Mailing Address
- Personal Phone Number
- Personal E-mail Address
- Employer Identification Number (EIN)/Taxpayer Identification Number (TIN)
- Network logon credentials(e.g., username and password, public key certificate)
- Other: DUNS Number
- How is the PII collected?
PII is collected through various applications' web forms residing on DOL.gov site and LaborNet intranet.
- How will the information be checked for accuracy?
All of the PII is submitted via web based forms within the applications. Validation techniques implemented within the forms (i.e. form field validation) verifies the data's accuracy before it is captured.
- What specific legal authorities, arrangements, and/or agreements defined the collection of information?
PII collections vary depending upon applications and owner agencies. Each application collects PII data per owner agencies' legal authorities. OPA DEC is only the custodian of the applications.
- Privacy Impact Analysis
The type of PII is limited to general business related information and is managed via administrative interfaces that can only be accessed via the DOL internal network.
Unauthorized Data Access (Confidentiality):
The data repository, which houses the collected information, is secured and access is tightly controlled. Only authorized system administrators and engineers have access to the data repository.
Data Integrity:
Restrictive account permissions control access to the data repository. Validation techniques implemented within the forms (i.e. form field validation) verifies the data's accuracy before it is captured.
USES OF THE PII
The following questions are intended to clearly delineate the use of information and the accuracy of the data being used.
- Describe all the uses of the PII
The PII is primarily used for various DOL agencies to plan and organize Conference Registrations, Meetings, Mailing Lists, Car Pooling etc.
- What types of tools are used to analyze data and what type of data may be produced?
Excel spread sheets are used to analyze the data for reporting purposes.
- Will the system derive new data, or create previously unavailable data, about an individual through aggregation of the collected information?
Various applications' web forms derive new data from DOL employees and members of public, but will not create previously unavailable data through aggregation of the collected information.
- If the system uses commercial or publicly available data, please explain why and how it is used.
The system does not use commercial or publicly available data.
- Privacy Impact Analysis
Various applications' web forms are transmitted through secured channels. In addition, the administrative interfaces can only be accessed via the DOL internal network.
RETENTION
The following questions are intended to outline how long information will be retained after the initial collection.
- How long is information retained in the system?
PII collections vary depending upon applications and owner agencies. Each application retains PII per owner agencies records management policy; OPA DEC is only the custodian of the applications.
- Has the retention schedule been approved by the DOL agency records officer and the National Archives and Records Administration (NARA)?
PII collections vary depending upon applications and owner agencies. Each application retains PII per owner agencies records management policy; OPA DEC is only the custodian of the applications.
- How is it determined that PII is no longer required?
PII collections vary depending upon applications and owner agencies. Each application retains PII per owner agencies records management policy; OPA DEC is only the custodian of the applications.
- What efforts are being made to eliminate or reduce PII that is collected, stored or maintained by the system if it is no longer required?
PII collections vary depending upon applications and owner agencies. Each application retains PII per owner agencies records management policy; OPA DEC is only the custodian of the applications.
- Privacy Impact Analysis
PII collections vary depending upon applications and owner agencies. Each application retains PII per owner agencies records management policy; OPA DEC is only the custodian of the applications.
INTERNAL SHARING AND DISCLOSURE
The following questions are intended to define the scope of sharing within the Department of Labor.
- With which internal organization(s) is the PII shared, what information is shared, and for what purpose?
Information regarding PII is shared within the owner agency of the application in the Department of Labor.
- How is the PII transmitted or disclosed?
PII is not transmitted or disclosed.
- Privacy Impact Analysis
The privacy risks associated with sharing of this information is mitigated by providing owner agencies' administrative users the access to the PII information. The administrative users will be authenticated using a username and a password.
- With which internal organization(s) is the PII shared, what information is shared, and for what purpose?
Information regarding PII is shared within the owner agency of the application in the Department of Labor.
- How is the PII transmitted or disclosed?
PII is not transmitted or disclosed.
- Privacy Impact Analysis
The privacy risks associated with sharing of this information is mitigated by providing owner agencies' administrative users the access to the PII information. The administrative users will be authenticated using a username and a password.
EXTERNAL SHARING AND DISCLOSURE
The following questions are intended to define the content, scope, and authority for information sharing external to DOL which includes federal, state and local government, and the private sector.
- With which external organization(s) is the PII shared, what information is shared, and for what purpose?
The PII is not shared with any external organization.
- Is the sharing of PII outside the Department compatible with the original collection? If so, is it covered by an appropriate routine use in a SORN? If so, please describe. If not, please describe under what legal mechanism the program or system is allowed to share the PII outside of DOL.
None.
- How is the information shared outside the Department and what security measures safeguard its transmission?
The PII is not shared with any external organization.
- Privacy Impact Analysis
Since there is no external sharing, no risks have been identified.
NOTICE
The following questions are directed at notice to the individual of the scope of PII collected, the right to consent to uses of said information, and the right to decline to provide information.
- Was notice provided to the individual prior to collection of PII?
Yes .There will be customized Privacy statements displayed on DOL.gov Web site and various applications' web forms that collect the PII.
- Do individuals have the opportunity and/or right to decline to provide information?
Yes.
- Do individuals have the right to consent to particular uses of the information? If so, how does the individual exercise the right?
Yes. They have the right to consent to particular use of the information by the prominent display of the privacy statements on DOL.gov Web site and various applications' web forms that collect the PII. These privacy statements clearly explains the purpose for which the collected PII will be used and tells the procedures to follow in order opt-out of information retention
- Privacy Impact Analysis
Individuals are made aware through the Privacy statements displayed on DOL.gov Web site and various applications' web forms that collect the PII. This way the risk associated with individuals being unaware of the collection is mitigated.
ACCESS, REDRESS, AND CORRECTION
The following questions are directed at an individual's ability to ensure the accuracy of the information collected about them.
- What are the procedures that allow individuals to gain access to their information?
Most applications do not allow individuals to gain access to their information. In the event that an application requires a username and password, users can request that this information be sent to them via email (forgot username/password functionality).
- What are the procedures for correcting inaccurate or erroneous information?
Instructions are provided within the applications for the data owners. Validation techniques implemented within the forms (i.e. form field validation) verifies the data's accuracy before it is captured.
- How are individuals notified of the procedures for correcting their information?
Not Applicable
- If no formal redress is provided, what alternatives are available to the individual?
The alternative for redress is to use owner agencies' contact information on the web form and contact them.
- Privacy Impact Analysis
No identified risk.
TECHNICAL ACCESS AND SECURITY
The following questions are intended to describe technical safeguards and security measures.
- What procedures are in place to determine which users may access the system and are they documented?
DOL.gov is accessible to the public via the Internet.
LaborNet resides within a DOL network and is only accessible to authorized DOL resources.
- Will Department contractors have access to the system?
Yes.
- Describe what privacy training is provided to users, either generally or specifically relevant to the program or system?
Relevant training for privacy and security is provided annually.
- What auditing measures and technical safeguards are in place to prevent misuse of data?
- Agencies who own the data are responsible for the implementing auditing measures; OPA DEC is only the custodian of the applications.
- OPA DEC is responsible for the DOL.gov and LaborNet systems at the application layer and above. As such, OPA DEC adheres to DOL's System Development Lifecycle Manual, as well as, guideline established within DOL's Computer Security Handbook.
- OSAM/ITC is responsible for the hardware and infrastructure that supports the DOL.gov and LaborNet systems.
- Privacy Impact Analysis
OPA DEC mitigates potential risks by adhering to established DOL guidelines and processes.
TECHNOLOGY
The following questions are directed at critically analyzing the selection process for any technologies utilized by the system, including system hardware, RFID, biometrics, and other technology.
- What stage of development is the system in, and what project development life cycle was used?
Operation and Maintenance stage of development and Monitoring and Controlling project development life cycle.
- Does the project employ technology which may raise privacy concerns? If so please discuss their implementation?
The project does not employ technology that may raise privacy concerns
DETERMINATION
As a result of performing the PIA, what choices has the agency made regarding the information technology system and collection of information? Office of Public Affairs Division of Enterprise Communication (OPA DEC) has completed the PIA for Department of Labor Web Production Environment System (DOL-WPES) which is currently in operation. OPA DEC has determined that the safeguards and controls for this moderate system adequately protect the information that the system collects, processes, stores or transmits. Office of Public Affairs Division of Enterprise Communication (OPA DEC) has determined that it is collecting the minimum necessary information for the proper performance of a documented agency function
